hotfix(netlink): fix dropping connections on firewall setup for all systems

[qdm12]

Description

WIP

Do this: #3152 (comment)

Issue

#3152

Assertions

• I am aware that we do not accept manual changes to the servers.json file
• I am aware that any changes to settings should be reflected in the wiki

[Copilot]

Pull request overview

This PR moves conntrack cleanup into firewall setup and adds iptables fallbacks when netlink flushing is unavailable.

Changes:

• Adds conntrack probing and AF_UNSPEC flushing.
• Adds iptables marking, reject/drop fallbacks, and parser support.
• Updates firewall wiring, PMTUD handling, and tests.

Review blockers (critical):

• iptables.go must return unclassified IPv4 setup errors instead of falling through to the IPv6 no-op.
• Replace or safely manage the global PUBLIC_ONLY chain name.
• Return ErrConntrackNetlinkNotSupported on unsupported platforms instead of panicking.
• Avoid unconditionally calling the panic-prone non-Linux mod.Probe.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Summary
internal/pmtud/tcp/tcp_integration_test.go	Updates firewall construction and skip diagnostics.
internal/pmtud/tcp/mss.go	Handles missing kernel modules.
internal/pmtud/tcp/helpers_test.go	Updates test firewall construction.
internal/pmtud/pmtud.go	Handles kernel-module failures.
internal/pmtud/pmtud_integration_test.go	Updates firewall construction.
internal/netlink/netlink.go	Probes conntrack netlink support.
internal/netlink/conntrack_unspecified.go	Defines unsupported-platform conntrack behavior.
internal/netlink/conntrack_linux.go	Updates conntrack flushing.
internal/firewall/iptables/tcp.go	Refines mark-module error handling.
internal/firewall/iptables/parse.go	Parses new iptables operations and targets.
internal/firewall/iptables/parse_test.go	Updates parser expectations.
internal/firewall/iptables/list.go	Parses connmark and reject rules.
internal/firewall/iptables/iptables.go	Adds fallback firewall rules.
internal/firewall/iptables/ip6tables.go	Handles missing kernel modules.
internal/firewall/iptables/firewall.go	Adds a kernel-module error sentinel.
internal/firewall/iptables/atomic.go	Updates mutex documentation.
internal/firewall/interfaces.go	Extends firewall and logger interfaces.
internal/firewall/flush.go	Implements connection-cleanup fallback orchestration.
internal/firewall/flush_test.go	Tests fallback orchestration.
internal/firewall/firewall.go	Injects the netlink dependency.
internal/firewall/enable.go	Runs connection cleanup during enablement.
cmd/gluetun/main.go	Wires netlink into firewall setup.

Suppressed comments (3)

internal/firewall/iptables/iptables.go:259

• These exceptions only recognize RFC1918/ULA/link-local/loopback, but routing.LocalNetwork is built from arbitrary directly connected route prefixes (including globally routed IPv6 LANs). When conntrack flushing fails and the permanent mark fallback is installed, an existing connection to such a configured local network hits PUBLIC_ONLY and is dropped before the later local-subnet ACCEPT rule. Include the configured local prefixes in the exceptions.

	ipv6PrivatePrefixes := []netip.Prefix{
		netip.MustParsePrefix("fc00::/7"),
		netip.MustParsePrefix("fe80::/10"),
		netip.MustParsePrefix("::1/128"),
	}

internal/firewall/iptables/parse.go:310

• For the new -m connmark --mark 0x567 syntax, this branch returns at the strings.HasPrefix case before consuming the mark value. The outer parser then stores 0x567 in instruction.mark, while parseChainRuleOptionalFields stores the listed rule in rule.connMark, so deleteIPTablesRule cannot match connmark rules. Parse the --mark value into instruction.connMark here, including the optional inversion marker.

	case "connmark":
		consumed++
		switch {
		case len(fields[consumed:]) == 0 || strings.HasPrefix(fields[consumed], "-"):
			// end or another flag

internal/pmtud/tcp/mss.go:46

• This new missingMarkModule branch does not reach callers. When every destination returns this error, mss remains zero and the function returns the generic all ... unreachable error below; when any destination succeeds, it returns nil. Consequently tcp.PathMTUDiscover never receives ErrKernelModuleMissing, so the new ICMP fallback in pmtud.go is ineffective for this case. Preserve and return the stored module error in the no-MSS path, and cover it with a test.

			missingMarkModule := errors.Is(result.err, iptables.ErrKernelModuleMissing) ||
				errors.Is(result.err, iptables.ErrMarkMatchModuleMissing)
			switch {
			case err != nil: // error already occurred for another findMSS goroutine
			case missingMarkModule:

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.